Executive brief
The Word Count and Social Shares plugin for WordPress contains a security flaw that allows low-privileged users, such as subscribers, to delete important files from the website's server. By deleting critical configuration files, an attacker can force the website into a setup state and take full control of the site. This could lead to a complete loss of website data, unauthorized access to customer information, and total service disruption.
Technical details
The Word Count and Social Shares plugin (up to version 1.0) is vulnerable to arbitrary file deletion via path traversal. The software fails to validate user-supplied file paths before deletion and lacks proper authorization and Cross-Site Request Forgery (CSRF) checks. An authenticated attacker with low-level privileges (e.g., a Subscriber) can exploit this to delete sensitive files such as 'wp-config.php'. Deleting 'wp-config.php' allows an attacker to re-run the WordPress installation process and gain full administrative control over the site. As of the advisory date, there is no known fix available.
Affected products
- Unknown Word Count and Social Shares <= 1.0
Timeline
- 2026-06-23: disclosed: Publicly published by WPScan
- 2026-07-14: advisory: CVE published in NVD dataset